1. PEM PAL IA COP Audit in Practice Working Group Hospital Case
Jean-Pierre Garitte
Skopje
8 April 2019

2. Hospital case
From the scenario provided we have identified a number of business objectives:
Drug prescription and consumption should be under control
Handling of instruments in the surgery room should be well managed
Finances of the hospital should be in balance
Patients’ valuables should be protected
Doctors are eager to work for our hospital
The hospital is adequately staffed
Based on the business objectives internal audit can define his/her audit objectives.

3. Audit objectives (1) From the business objective:
Drug prescription and consumption should be under control.
We define our audit overall objective:
To assure that drug prescription and consumption are under control.

4. Audit objectives (2) Audit objective:
To assure that drug prescription and consumption are under control.
This audit objective can be broken down in several sub-objectives:
To assure that adequate drugs are prescribed for every patient
To assure that the amounts of drugs can be accounted for
To assure that access to drugs is well controlled
To assure that drugs are at all times available when needed
To achieve the various audit objectives the auditor needs to assess the controls in the processes involved.

5. Processes in scope for audit
Prescription of drugs
Provision of drugs to patients
Purchasing of drugs
Access to drugs

6. Reference frameworks COSO internal control framework
National regulation on medication
Internal procedures
Applicable protocols
Quality handbook

7. Skills and expertise needed
Medical knowledge (!) for examination of medical files
Data analytics

8. Inherent risks to the various processes
Doctors prescribe the wrong drugs
The drugs prescribed may cause problems to the patients
Patients receive different drugs than prescribed
Patients do not receive their drugs
Patients do receive their drugs but do not take them
Drugs are stolen by patients
Drugs are stolen by hospital staff
Drugs are not available when needed
Accounting quantities of drugs do not match physical quantities

9. Expected mitigating controls (1)
Doctors prescribe the wrong drugs
Medical issue, out of scope for internal audit?
Automated match between diagnosis and prescribed drugs
Quality review by medical staff
Periodical statistics about usage of drugs

10. Expected mitigating controls (2)
The drugs prescribed may cause problems to the patients
Medical issue, out of scope for internal audit?
Patient file contains known allergies and current medicines
Manual / automated match between patient file and prescribed drugs

11. Expected mitigating controls (3)
Patients receive different drugs than prescribed
Nurses will review and sign off patient list with drugs to be given
Wrong drugs given to one patient will result in no drugs for another patient

12. Expected mitigating controls (4)
Patients do not receive their drugs
Review of patient lists

13. Expected mitigating controls (5)
Patients do receive their drugs but do not take them
Nurses have to wait until they can be sure that proper drugs have been taken by the patient
Sign-off on patient list means that drugs have been taken

14. Expected mitigating controls (6)
Drugs are stolen by patients
Drugs are stored in a secure place, only accessible by appropriate hospital safe on a need-to-access basis
Badge or key access only

15. Expected mitigating controls (7)
Drugs are stolen by hospital staff
Drugs are stored in a secure place, only accessible by appropriate hospital safe on a need-to-access basis
No access to drugs by doctors
Badge or key access only
Camera surveillance
Regular inventory count, at least for critical drugs

16. Expected mitigating controls (8)
Drugs are stolen by hospital staff
Drugs are stored in a secure place, only accessible by appropriate hospital safe on a need-to-access basis
Badge or key access only
Camera surveillance
Regular inventory count, at least for critical drugs

17. Expected mitigating controls (9)
Drugs are not available when needed
Safety stock applied to all drugs
FIFO approach in order to avoid expired drugs
Periodical statistics about usage of drugs

18. Expected mitigating controls (10)
Accounting quantities of drugs do not match physical quantities
Regular physical stock taking of inventories of drugs
Analysis of stock variances

19. Risk / control matrix

20. Questions & Answers